4 ms·

What do you mean by exploiting or owning a postscript printer? By its nature you send it programs expressed in a Turing complete language, and it executes them

What do you mean by exploiting or owning a postscript printer? By its nature you send it programs expressed in a Turing complete language, and it executes them. The Blue Book is a nice PostScript tutorial: http://www-cdf.fnal.gov/offline/PostScript/BLUEBOOK.PDF http://www-cdf.fnal.gov/offline/PostScript/BLUEBOOK.PDF

616c 10y ago
I thought I was to infer from the parent commenter that the fun is learning to write Postscript documents to send to a program and use vulnerabilities in Ghostscript, and that would be useful in compromising a printer itself. For example, if I want to DoS a printer, I send it a corrupt job, with intentionally nasty PS directives. I have seen people do that. But what if we take it a step further? I want print jobs stored on the printer, with potentially sensitive info. Do HP printers at the software level use Ghostscript on some models, and I can use known parsing problems to get gs to dump memory, or file system info, that I can later find through Embedded JetDirect admin web server or other means? Can I use it gain root and then make reverse shells? I know some modern printers run embedded Linux, but that's all I know. Again, I am interested to know if ghostscript is just a known Postscript platform generally or it is also used in printer themselves, is a useful exploit vector, and I am ignorant. Either way, I am ignorant. I am new to this domain and wish to learn more. Sorry for the dumb questions. (Also have the Blue Book in my list of lazy/bored reading materials.)
- tacostakohashi 10y ago
  ghostscript is licensed and embedded in some printers, so if you found and exploit, it's quite likely it would work on those printers too. However, I suggested it mainly as convenient implementation to learn & experiment with, since it's a very faithful implementation of the spec.
  - 616c 10y ago
    That's what I thought. Thanks though, your comments are still very useful.

616c 10y ago

I thought I was to infer from the parent commenter that the fun is learning to write Postscript documents to send to a program and use vulnerabilities in Ghostscript, and that would be useful in compromising a printer itself. For example, if I want to DoS a printer, I send it a corrupt job, with intentionally nasty PS directives. I have seen people do that. But what if we take it a step further? I want print jobs stored on the printer, with potentially sensitive info. Do HP printers at the software level use Ghostscript on some models, and I can use known parsing problems to get gs to dump memory, or file system info, that I can later find through Embedded JetDirect admin web server or other means? Can I use it gain root and then make reverse shells? I know some modern printers run embedded Linux, but that's all I know. Again, I am interested to know if ghostscript is just a known Postscript platform generally or it is also used in printer themselves, is a useful exploit vector, and I am ignorant. Either way, I am ignorant. I am new to this domain and wish to learn more. Sorry for the dumb questions. (Also have the Blue Book in my list of lazy/bored reading materials.)

tacostakohashi 10y ago
ghostscript is licensed and embedded in some printers, so if you found and exploit, it's quite likely it would work on those printers too. However, I suggested it mainly as convenient implementation to learn & experiment with, since it's a very faithful implementation of the spec.
- 616c 10y ago
  That's what I thought. Thanks though, your comments are still very useful.